A Heads-Up on Microsoft, DMARC and Your Emails
Affects business emails from Microsoft 365, Google Workspace and other platforms when they’re sent from a domain without DMARC to personal Microsoft accounts (Outlook.com, Hotmail, Live and MSN).
We started our week by discovering that Microsoft has changed how it handles emails from domains that don’t have a DMARC policy. There was no announcement, no blog post and no warning. Emails simply started bouncing.
If you’re sending to anyone with a Hotmail, Outlook.com, Live or MSN address, this could be affecting you right now. I wanted to explain what’s going on in plain terms, how to check whether you’re affected, and what to do about it.
TL;DR: Since 5 November 2026, Outlook.com, Hotmail, Live and MSN have been rejecting some emails from domains with no DMARC record, even when SPF and DKIM pass. To fix it, publish a DMARC record in your DNS. A monitoring policy (p=none) is enough to get your emails delivered again.
What’s actually happening?
Since the 5th November 2026, Microsoft’s personal email services (Outlook.com, Hotmail, Live and MSN) have been rejecting some messages from domains that have no DMARC record. This happens even when your other email security records, SPF and DKIM, are set up correctly.
The sender gets a bounce-back that reads something like “Message rejected: Message lacks SPF/DKIM/DMARC Auth Records”. It’s also a bit hit and miss: some emails get through and others don’t, which makes it easy to miss.
The impact is that emails simply don’t arrive. For a business, that could be an invoice or a quote. For a school, it might be a letter home or a trip consent form sent to a parent’s address. Microsoft won’t try to deliver a rejected email again, so anything that bounced needs to be resent.
It’s worth saying that this only affects emails to Microsoft’s personal mailboxes. Emails to your colleagues, or to other organisations on Microsoft 365, don’t seem to be affected at the moment.
Why has Microsoft done this?
Microsoft hasn’t explained it yet, but the direction of travel isn’t a surprise. Last year Microsoft started requiring DMARC from organisations sending more than 5,000 emails a day to its personal mailboxes, and Google and Yahoo did the same before that. It now looks like Microsoft has removed that threshold altogether.
The reason behind all of this is the same: phishing. DMARC is an essential protection that stops criminals sending emails that look like they came from your domain. Every big provider is now asking senders to prove they are who they say they are.
Are you affected?
The quickest way to find out is to check whether your domain has a DMARC record. Pop your domain name into the box below (the part after the @ in your email address) and it’ll tell you in a couple of seconds.
Check your domain
Enter the part of your email address after the @ to see if it has a DMARC policy.
If it comes back with a green tick, you’re fine for now and there’s nothing urgent to do. If it comes back with a red cross, you’re at risk of your emails being rejected and it’s worth acting this week.
The other tell-tale sign is a bounce-back since early November that mentions SPF, DKIM or DMARC. If anyone has mentioned recently that they didn’t receive something from you, this might be why.
The immediate fix
The good news is that the fix is simple. You need to publish a DMARC policy for your domain, which is a single line added to your domain’s DNS settings.
The minimum requirement is just to have a policy. You don’t have to switch on enforcement straight away. A policy set to p=none tells receiving servers that you’re monitoring your email rather than blocking anything. It won’t stop any of your own emails from being delivered, and it’ll start sending you reports on who is sending email using your domain. Those reports become really useful later on.
A basic record looks something like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.co.ukIf you’re comfortable in your DNS settings, it’s a five-minute job. If you’re not, or you’d just rather someone else did it, we’re happy to help. Just drop us a line and we’ll get it sorted for you, usually the same day.
What next?
Publishing a monitoring policy gets your emails flowing again, but it’s only the first step. The real value of DMARC comes when you enforce it. That means telling receiving servers to quarantine or reject any email that claims to be from you but isn’t, which stops criminals using your domain to send phishing emails to your customers.
This is where it pays to take your time. Most organisations have more systems sending email on their behalf than they realise. There’s your website contact form, your finance or invoicing software, newsletter tools, a school’s MIS or parent app, your CRM, and sometimes a printer or scanner too. If you switch on enforcement before every one of those is set up properly, you can end up blocking your own legitimate emails, which is exactly the disruption we’re trying to avoid.
Done properly, it’s a planned process. We review the DMARC reports, identify every service using your domain, make sure each one is authenticated correctly, and then tighten the policy in stages. Depending on how many systems you have, it can take several weeks or months. We would be glad to support you through it.
Frequently asked questions
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a record published in your domain’s DNS. It tells receiving mail servers what to do with emails that claim to come from your domain but fail SPF and DKIM checks, and where to send reports about them. It’s one of the main protections against criminals sending phishing emails that look like they came from you.
Does this affect emails to Microsoft 365 business mailboxes?
Not at the moment. The rejections only affect emails sent to Microsoft’s personal mailboxes (Outlook.com, Hotmail, Live and MSN). Emails to your colleagues, or to other organisations on Microsoft 365, don’t seem to be affected.
Will a p=none DMARC policy stop my emails being delivered?
No. A p=none policy only tells receiving servers that you’re monitoring your email. It doesn’t block anything, and it starts sending you reports on who is sending email using your domain.
Do I need to resend emails that bounced?
Yes. Microsoft won’t try to deliver a rejected email again, so anything that bounced since early November needs to be resent once your DMARC record is in place.
How long does it take to set up DMARC?
Publishing a basic monitoring policy is about a five-minute job if you’re comfortable in your DNS settings. Moving to full enforcement, where spoofed emails are quarantined or rejected, is a planned process that can take several weeks or months depending on how many systems send email on your behalf.
Any questions?
I know changes like this can feel like one more thing on an already long list, especially when they arrive without warning. If you’re not sure where you stand, run the check above or just give us a call. We’re always happy to take a look.
Get in touch with our experts
Let’s discuss how we can best assist your organisation with its IT & digital challenges. No matter how big or small, our team of experts will work with you to determine the best actions forward for your IT.